apache/hadoop · error · IOException

SASL is configured for registry, but neither keytab/principa

Error message

SASL is configured for registry, but neither keytab/principal nor java.security.auth.login.config system property are specified

What it means

In SASL mode RegistrySecurity.applySecurityEnvironment needs a JAAS configuration for the Curator client. If the java.security.auth.login.config system property is unset/empty AND no registry Kerberos principal+keytab were supplied (fields set only via setKerberosPrincipalAndKeytab), it cannot build or find a JAAS configuration and throws this IOException stating exactly that. Note the two escape hatches it checks: an external JAAS file, or principal+keytab from which it generates an in-memory JaasConfiguration.

Source

Thrown at hadoop-common-project/hadoop-registry/src/main/java/org/apache/hadoop/registry/client/impl/zk/RegistrySecurity.java:759

    if (isSecureRegistry()) {
      switch (access) {
        case anon:
          clearZKSaslClientProperties();
          break;

        case digest:
          // no SASL
          clearZKSaslClientProperties();
          builder.authorization(SCHEME_DIGEST, digestAuthData);
          break;

        case sasl:
          String existingJaasConf = System.getProperty(
              "java.security.auth.login.config");
          if (existingJaasConf == null || existingJaasConf.isEmpty()) {
            if (principal == null || keytab == null) {
              throw new IOException("SASL is configured for registry, " +
                  "but neither keytab/principal nor java.security.auth.login" +
                  ".config system property are specified");
            }
            // in this case, keytab and principal are specified and no jaas
            // config is specified, so we will create one
            LOG.info(
                "Enabling ZK sasl client: jaasClientEntry = " + jaasClientEntry
                    + ", principal = " + principal + ", keytab = " + keytab);
            JaasConfiguration jconf =
                new JaasConfiguration(jaasClientEntry, principal, keytab);
            javax.security.auth.login.Configuration.setConfiguration(jconf);
            setSystemPropertyIfUnset(ZKClientConfig.ENABLE_CLIENT_SASL_KEY,
                                     "true");
            setSystemPropertyIfUnset(ZKClientConfig.LOGIN_CONTEXT_NAME_KEY,
                                     jaasClientEntry);
          } else {
            // in this case, jaas config is specified so we will not change it
            LOG.info("Using existing ZK sasl configuration: " +

View on GitHub (pinned to 2add963021)

Solutions

Set -Djava.security.auth.login.config=/path/jaas.conf with a file that defines the hadoop.registry.jaas.context entry (default 'Client').
Or call curatorService.setKerberosPrincipalAndKeytab(principal, keytabPath) before start so an in-memory JaasConfiguration is generated (the branch right after this check).
If the property is set but the entry is missing, you will hit validateContext instead — fix the file contents per that error.

Example fix

// before: SASL registry client, no JAAS property and no keytab/principal wired
RegistryOperations ops = RegistryOperationsFactory.createKerberosInstance(conf, null, null);

// after: provide a JAAS config file, or supply principal + keytab
System.setProperty("java.security.auth.login.config", "/etc/security/jaas.conf");
RegistryOperations ops = RegistryOperationsFactory.createKerberosInstance(conf, principal, keytabPath);

Defensive patterns

Strategy: validation

Validate before calling

// pre-flight for SASL registry clients
boolean hasJaasFile = StringUtils.isNotEmpty(
    System.getProperty("java.security.auth.login.config"));
boolean hasKeytab = principal != null && keytab != null;
if (!hasJaasFile && !hasKeytab) {
  throw new IllegalStateException(
      "SASL registry needs either -Djava.security.auth.login.config or kerberos principal+keytab");
}
// if no file: wire the keytab so an in-memory JaasConfiguration is generated
curatorService.setKerberosPrincipalAndKeytab(principal, keytabPath);

Try / catch

try {
  RegistryOperations ops = RegistryOperationsFactory.createKerberosInstance(conf, principal, keytab);
} catch (IOException e) {
  if (e.getMessage().contains("neither keytab/principal nor java.security.auth.login.config")) {
    // set the JAAS system property or pass principal/keytab so a JaasConfiguration can be built
  }
}

Prevention

Pass -Djava.security.auth.login.config in every JVM that uses SASL registry, and verify it in deployment smoke tests.
Alternatively always wire principal+keytab via setKerberosPrincipalAndKeytab / the factory method.
Treat this error as the 'no JAAS source at all' case: if the file exists but the entry is missing you get the validateContext error instead.

When it happens

Trigger: client.auth=kerberos on a JVM without the JAAS system property, on a CuratorService/RegistryOperationsService whose setKerberosPrincipalAndKeytab was never called — e.g. a custom registry client that skips the keytab wiring YARN's own client normally performs.

Common situations: Custom registry tooling that configures SASL but relies on a JAAS file that deployment no longer passes; containerized services where -Djava.security.auth.login.config was dropped from JVM options; test harnesses moving from jaas-file auth to keytab auth half-way.

Related errors

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/53e2161c6d0f6c0c. Report an issue: GitHub.